- скопировать содержимое кода в буфер обмена;
- стартуем uVS(start.exe), далее выбираем: текущий пользователь, меню - скрипты - выполнить скрипт из буфера обмена;
- закрываем все браузеры перед выполнением скрипта;
при деинсталляции программ - соглашаемся на деинсталляцию_удаление подтверждаем "да"
Код |
---|
;uVS v3.86.5 [http://dsrt.dyndns.org] ;Target OS: NTv6.1 v385c OFFSGNSAVE zoo %SystemRoot%\SYSWOW64\NETUPDSRV.EXE addsgn 1AA3E79A5583D98CF42B254E3143FE86C9AA77B381AC48128D9A7B84B49771C15EF730F2B71065C26E8CDB1603EA177FBDABE48455D2C42BEA32502F879F23FE 8 NetworkUpdate.mbam zoo %SystemDrive%\PROGRAM FILES (X86)\TOTAL-1.8\AC58A772-02C5-4C9E-99C7-48126969A43E.EXE addsgn 1AA0DA9A5583338CF42B627DA804455376B9037DCDDE0B7345BED1FBDB82555CD4CF348DBD8D9DC06FA490161232597139FBF47995A7A46BA623803730DED5A9 8 Toolbar.CrossRider zoo %SystemDrive%\PROGRAM FILES (X86)\TOTAL-1.8\TOTAL-1.8-CODEDOWNLOADER.EXE addsgn 1A9FA99A5583338CF42B627DA804DEC9E946303A4536482ED6F03A3714F26547E36AD710B501B959DC587345C5CE497339FBFCFB01FEA0A76953B824077B3634 8 Toolbar.CrossRider zoo %SystemDrive%\PROGRAM FILES (X86)\TOTAL-1.8\508EE7D3-9E85-4522-B9EF-3668E10AAC2C-11.EXE addsgn 1AD6779B5583338CF42BFB3A889E99702D0F0A8E8012727984C3FE8C2CD199282216C3DC0EBDCA482A800F9BF648143928540424BDBAEF2C2DFC54AA317325CB 8 Toolbar.CrossRider zoo %SystemDrive%\PROGRAM FILES (X86)\TOTAL-1.8\508EE7D3-9E85-4522-B9EF-3668E10AAC2C-5.EXE addsgn 1AE2BC9A55834C720BD4C4A50CE09F422562FFBC89FAF70F98C3C5B3E7261B4ECBB609573E0C2504718084F97F1349FA3DDF9C7666015B1F8C4BA46FC7879A73 8 Toolbar.CrossRider zoo %SystemDrive%\PROGRAM FILES (X86)\TOTAL-1.8\DEB7A455-F433-4E51-830F-5EF08F969262.EXE addsgn 0DC977BA156A4C720BD4AEB164C81205258AFCF689FA1F7885C3C5BC50D6714C2117D3573E55BD492B009C9F461671FA7D5FE87255DAB02C2D77A42FC7062273 33 Toolbar.Crossrider zoo %SystemDrive%\PROGRAM FILES (X86)\GLOBALUPDATE\UPDATE\GOOGLEUPDATE.EXE addsgn 1A81699A5583C58CF42B254E3143FE865882FC82A4056A70EFC33A894C71314CDC02B7E77E5518895E98D277D61749FAF62F1767696AF02C7D9FE42EC7067BFA 8 Adware.Boxore.5 [DrWeb] zoo %SystemRoot%\SYSWOW64\NETHTSRV.EXE addsgn 1ABC099A5583D98CF42B254E3143FE86C9AA77B381AC48128D9A7B04549471C15EF730F2B71065C26E8CDB1603EA177FBDABE48455D2C42BEA32502F879F23FE 8 NetUpdate.mbam zoo %SystemDrive%\PROGRAM FILES (X86)\GLOBALUPDATE\UPDATE\1.3.25.0\GOOGLEUPDATEBROKER.EXE addsgn 1A5D639A5583C58CF42B254E3143FE8E6886F34198AC940D8DCC72BA7B142639363C3231BB87E947A8418690F107464D79D1C3B02137EF72A8B7DD2A44CEDD2E 8 Adware.Boxore.2 [DrWeb] zoo %SystemDrive%\PROGRAM FILES (X86)\GLOBALUPDATE\UPDATE\1.3.25.0\GOOGLEUPDATEONDEMAND.EXE zoo %SystemDrive%\USERS\AL.GRACHEV\APPDATA\LOCAL\TEMP\IS2036094744\8717172_STP\BATBROWSESETUP.EXE addsgn 7300F79B556A1F275DE775E6ED94361DE2CED8E6E96B5F78B63503F874C251B33627B3173E3D9CC92B807B8AF66609FA2E20FD0E279AB04625D49C108506CA82 59 Win32/BrowseFox zoo %SystemDrive%\PROGRAM FILES (X86)\TOTAL-1.8\UTILS.EXE addsgn A76592CD0339CD9EA7D5AEB19BDD66C6618A3BF2ADFB9F78853CD0E49492711FE413E7573E559DB63E1840DB4640EABA469BE8B551FEB82C2D774CA2FC0622D0 48 Toolbar.CrossRider zoo %SystemDrive%\PROGRAM FILES\UNLOCKER\UNINST.EXE zoo D:\PROGRAM FILES (X86)\WEBMONEY\WEBMONEY.EXE addsgn 9204779A556A11225ADB6446B654E5D72A4017F9301110C06EC47C575F469A44DEFCC8A5D5A076BFD96B8C62ADFFBA11992301EF5A133BE6DAA6FD7797572DB9 8 Trojan.SMSSend.1552 [DrWeb] zoo %SystemDrive%\PROGRAM FILES (X86)\SAFERVPN\UNINSTALL.EXE del %SystemRoot%\TASKS\A737F1E5-0796-4695-85CE-75C86EDECFB0.JOB del %Sys32%\TASKS\A737F1E5-0796-4695-85CE-75C86EDECFB0 hide D:\PROGRAM FILES (X86)\WEBMONEY\WEBMONEY.EXE hide %SystemDrive%\PROGRAM FILES\UNLOCKER\UNINST.EXE hide %SystemDrive%\PROGRAM FILES (X86)\SAFERVPN\UNINSTALL.EXE ;------------------------autoscript--------------------------- chklst delvir delref STATS.LOADCLIENTINPUTSRV.COM delref ERRORS.LOADCLIENTINPUTSRV.COM delref LOGS.LOADCLIENTINPUTSRV.COM delref %SystemDrive%\USERS\AL.GRACHEV\PAYJZ\START.VBS delref %SystemDrive%\USERS\AL.GRACHEV\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\START.LNK delref JS.LOADCLIENTINPUTSRV.COM delref JS.CLIENTDEMOCLOUD.COM delref HTTP://UPDATE.LOADCLIENTINPUTSRV.COM/IE_CODE_AGENT_UPDATES/{CAMP_ID}/UPDATE.JSON' delref %SystemDrive%\USERS\AL.GRACHEV\APPDATA\LOCAL\14302\A16443.EXE delref %SystemDrive%\PROGRAM FILES (X86)\FUN COUPONS\FUN_COUPONS_NOTIFICATION_SERVICE.EXE delref HTTP://CDN.SELECTBESTOPT.COM/NOTF_SYS/INDEX.HTML' delref HTTP://STATS.BUILDOMSERV.COM/DATA.GIF?' delref HTTP://LOGS.BUILDOMSERV.COM/MONETIZATION.GIF?' delref %SystemDrive%\PROGRAM FILES (X86)\FUN COUPONS\FUN_COUPONS_UPDATING_SERVICE.EXE delref HTTP://CDN.BUILDOMSERV.COM/TXT/@CAMPID@/@VER@/FILE.TXT delref STATS.BUILDOMSERV.COM delref 0HTTP://ECASTATS.COM/ROWS/UNIMPORTED2.RUI delref %SystemDrive%\PROGRA~2\DOWNLO~1\DMIEHLP.DLL delref {D5FEC983-01DB-414A-9456-AF95AC9ED7B5}\[CLSID] deldirex %SystemDrive%\PROGRAM FILES (X86)\GLOBALUPDATE\UPDATE\1.3.25.0 deldirex %SystemDrive%\PROGRAM FILES (X86)\BETTERSURF deldirex %SystemDrive%\PROGRAM FILES (X86)\BETTERSURF\BETTERSURFPLUS deldirex %SystemDrive%\PROGRAM FILES (X86)\WEBEXPENHANCEDV1\WEBEXPENHANCEDV1ALPHA562 delref HTTP://ECASTATS.COM/ROWS/UNIMPORTED2.RUI delref HTTP\U003A//WWW1.DELTA-SEARCH.COM/\U003FBABSRC\U003DHP_SS\U0026MNTRID\U003D9833BCAEC5D709CD\U0026AFFID\U003D122471\U0026TSP\U003D4979 deldirex %SystemDrive%\USERS\AL.GRACHEV\APPDATA\LOCAL\SWVUPDATER delref 199.200.120.37:8089 delref HTTP://YAMDEX.NET/?SEARCHID=1&L10N=RU&FROMSEARCH=1&IMSID=C23F7F390ED17BF59DBD4ABA15962A39&TEXT={SEARCHTERMS} delref %SystemDrive%\USERS\AL.GRACHEV\APPDATA\ROAMING\QIPGUARD\QIPGUARD.EXE deldirex %SystemDrive%\USERS\AL.GRACHEV\APPDATA\ROAMING\VOPACKAGE deldirex %SystemDrive%\USERS\AL.GRACHEV\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\VOPACKAGE delref HTTP://WWW.QIP.RU/ regt 28 regt 29 ; OffersWizard Network System Driver exec C:\Program Files (x86)\Common Files\Config\uninstinethnfd.exe ; Remote Desktop Access (VuuPC) exec C:\Users\al.grachev\AppData\Roaming\VOPackage\uninstall.exe ; Java(TM) 6 Update 29 exec MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216029FF} /quiet deltmp delnfr ;------------------------------------------------------------- restart |
перезагрузка, пишем о старых и новых проблемах.
------------
+
добавьте новый образ автозапуска по данному компу.